registry / @zerohash-sdk/csp-crypto-withdrawals-js / 1.15.7
@zerohash-sdk/csp-crypto-withdrawals-js@1.15.7
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install hooks, and the inspected runtime behavior is consistent with a widget SDK: caller-triggered loading from Zerohash CDNs and limited failure reporting to Zerohash collectors. No concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls render() to display the widget; diagnostics are sent if script loading fails.
Impact
No harmful effect was established; the observed network activity supports widget loading and failure diagnostics.
Mechanism
The SDK loads a widget from Zerohash CDN hosts and posts failure details, browser metadata, and parsed JWT claims to an environment-specific Zerohash collector.
AI rationale
The manifest has no install hooks, and the inspected runtime behavior is consistent with a widget SDK: caller-triggered loading from Zerohash CDNs and limited failure reporting to Zerohash collectors. No concrete attack behavior was found.
Network endpoints10
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies dist/index.js as the entrypoint and contains no lifecycle scripts.
- The declaration source shows that rendering calls the loader after a caller invokes render().
- The runtime uses Zerohash SDK CDN hosts for the widget and Zerohash Faro collectors for diagnostics.
- Diagnostics are sent when widget loading fails and include browser and page metadata plus parsed JWT claims; the inspected payload does not send the raw JWT.
Evidence against
- The package performs network requests to load its widget and send load-failure diagnostics, but the inspected destinations and behavior match the SDK’s stated purpose.
Behavioral surface
Network
UrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg90async render(container: HTMLElement): Promise<void> {
// Validate container
if (!container || !(container instanceof HTMLElement)) {
throw new Error(this.errorMessages.INVALID_CONTAINER);
}
// Check if already rendered
if (this.state.initialized) {
throw new Error(this.errorMessages.ALREADY_RENDERED);
}
try {
Low
Ai Review Evidence
The declaration source shows that rendering calls the loader after a caller invokes render().
dist/index.d.tsView on unpkg · L90227// The shared loader also reports failures to Faro (with JWT claims for
// partner/participant context) and removes a failed tag so a later
// render() call can retry cleanly.
this.scriptLoadingPromise = new Promise<void>((resolve, reject) => {
loadWebComponentScript({
webComponentTag: this.webComponentTag,
appName: this.webComponentTag,
scriptUrls: this.getEffectiveScriptUrls(),
collectorUrls: FARO_COLLECTOR_URLS,
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-withdrawals-js@1.15.7.
See all versions of @zerohash-sdk/csp-crypto-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-js@1.15.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.